Detecting Spam Zombies by Monitoring Outgoing Messages

Zhenhai Duan

Department of Computer Science

Florida State University

2

Outline

• Motivation and background

• SPOT algorithm on detecting compromised machines

• Performance evaluation

• Summary

3

Motivation

• Botnet becoming a major security issue– Spamming, DDoS, and identity theft

• Hard to defend botnet based attacks– Sheer volume, wide spread

• Lack of effective method to detect bots in local networks

4

Motivation

• Utility-based online detection method

• SPOT– Detecting subset of compromised machines involved in

spamming

• Bots increasingly used in sending spam– 70% - 80% of all spam from bots in recent years– In response to blacklisting– Spamming provides key economic incentive for controller

5

Network Model

• Machines in a network– Either compromised H1 or normal H0

–

• How to detect if a machine compromised as msgs pass SPOT sequentially?– Sequential Probability Ratio Test (SPRT)

)|0Pr()|1Pr( 01 HXHX ii

6

Sequential Probability Ratio Test

• Statistical method for testing– Null hypothesis against alternative hypothesis

• One-dimensional random walk – With two boundaries corresponding to hypotheses

A B

7

SPRT

• Advantages– Online algorithm

• Applying to observations arriving sequentially– Fast detection

• Minimizing average number of observation required– Controlled results

• False positive and false negative errors can be bounded by user-specified thresholds

8

SPRT

• X denote a Bernoulli random variable with unknown parameter θ

• SPRT tests null hypothesis H0 θ = θ0 against alternative hypothesis H1 θ = θ1

111

000

)|0Pr(1)|1Pr(

)|0Pr(1)|1Pr(

HXHX

HXHX

ii

ii

9

SPRT

• How likely to have sequence of X1, X2, …, Xn, under H1 and H0, respectively?

)|,...,,Pr(

)|,...,,Pr(ln

021

121

HXXX

HXXX

n

nn

n

ii

i

in

iin

in

n ZHX

HX

HX

HX

10

1

101

11

)|Pr(

)|Pr(ln

)|Pr(

)|Pr(ln

1,ln

0,1

1ln

0

1

0

1

i

i

X

XiZ

10

SPRT Test Process

• Given two constant A and B, where A < B, at each step n, compute

• How to determine A and B– Let α and β be user-desired false positive and negative rates

n

1

ln,1

ln BA

11

SPRT Bounds

• Relationship between actual false positive α’ and false negative β’ and desired ones α and β

• Average number of observation to reach decision

''

''

1,

1

0

11

0

11

0

0

11

0

11

1

11

ln)1(ln

1ln

1ln)1(

]|[

11

ln)1(ln

1ln)1(

1ln

]|[

HNE

HNE

12

SPOT Detection Algorithm

• Based on SPRT– H1: machine is compromised

– H0: machine is normal

• Maintain Λn for each IP observed

• Update Λn in each step

• Compare Λn to A and B

• Terminate when B is approached• Restart when A is approached

– after resetting Λn

13

Determining SPOT Parameters

• Four parameters: α, β, θ0, θ1

– α, β are user desired error rates, normally in range 0.01 to 0.05

– Ideally, θ0 and θ1 should be probability a normal and compromised machine send spam

– SPOT does not require precise knowledge of θ0 and θ1

• An imprecise (but reasonably) knowledge of θ0 and θ1 will only affect N

• In practice, they can model the false positive and detection rate of spam filter

14

Averaged Number of Observations Required

• β = 0.01

15

Trace-based Performance Evaluation

• Two month email trace received on FSU campus net• SpamAssassin and anti-virus software

– About 73% of all emails are spam

16

Sending IP Addresses

– FSU has higher percentage of mixed IP addresses

– FSU has higher percentage of IP addresses sending virus

17

Performance of SPOT

– Α = 0.01, β = 0.01, θ0 = 0.2, θ1 = 0.9

– 110 confirmed by virus information– 16 confirmed by high spam sending percentage (> 98%)

• 62.5% of these are dynamic IP– 6 cannot be confirmed by either way

– 7 machines SPOT identified as normal carried virus

18

Number of Actual Observations

19

Impacts of Dynamic IP Addresses

• SPOT assumes one-to-one mapping between IP address and machine

• Intuitively, dynamic IP will not have any major impacts, given fast detection of SPOT

20

Distribution of Spam in Each Cluster

– T = 30 minutes– 90% of clusters >= 10 spam– 96% of clusters >= 3 spam

21

Discussions

• Practical deployment issues– Msgs may pass a few relay servers before leaving network– Method 1: deploy SPOT at each relay server– Method 2: identify originating machine by Received header

• Limitation – IID assumption of message arrivals

22

Summary

• SPOT– Effective and efficient spam zombie detection system– Based Sequential Probability Ratio Test

• A utility-based detection scheme– How to generalize the idea to detect compromised machines

used for other purposes?